moonshot-voting-x52[.]netlify[.]app

This domain, moonshot-voting-x52.netlify.app, is currently under investigation for brand impersonation targeting Moonshot, a known entity in the cryptocurrency sector. The specific threat type involves luring users into interacting with a fraudulent voting mechanism, likely designed to harvest sensitive information or manipulate token holders into unauthorized transactions. The page title, 'Moonshot – Vote your token to get listed!', directly references the legitimate brand, increasing the likelihood of deception among unsuspecting users seeking to participate in token listings or community governance. Infrastructure analysis reveals the following technical indicators: the domain has zero detections out of 95 engines on VirusTotal, indicating it has not yet been widely flagged by security vendors. It is hosted on Netlify, a legitimate platform often exploited for rapid deployment of fraudulent sites due to its ease of use and free SSL certificates. The domain resolves to the IP address 35.157.26.135, which is associated with cloud infrastructure and has not been previously blocklisted for malicious activity. The SSL certificate is issued by DigiCert Inc, a reputable certificate authority, which adds a layer of perceived legitimacy. No creation date is provided, but the domain remains active and unflagged by major blocklists or threat intelligence feeds at the time of this assessment. To mitigate risks associated with this brand impersonation threat, users should avoid interacting with the domain, particularly any prompts to connect wallets, submit credentials, or vote on token listings. Organizations targeted by such impersonation should monitor for similar domains using variations of their brand name, especially those hosted on platforms like Netlify, Vercel, or GitHub Pages. Implementing DNS-based blocking for the resolved IP (35.157.26.135) and monitoring for SSL certificates issued to suspicious subdomains can help prevent further exposure. Users who have already engaged with the site should revoke any connected wallet permissions and monitor their accounts for unauthorized transactions. Reporting the domain to Netlify’s abuse team and relevant threat intelligence platforms can aid in takedown efforts and prevent further exploitation.